I think libmcrypt dependency is not serious (dead project for 18 years)

From configure.ac, this is an optional dependency (but with missing features).

IMHO, this needs to be reported upstream, https://github.com/NagiosEnterprises/nsca, even if the project doesn't seem very active (no commit for 2 years)

I also notice there is an nsca-ng package, which seems to be a drop-in replacement.

See "Compatibility" in https://nsca-ng.org/

nsca could be built without the libmcrypt dependency, but that would void any possibility to crypt messages between the client and the server.
It would indeed make sense for upstream to move to a maintained and reliable crypto lib.